CVE-2026-16769: RS9116W/SiWx917 DoS Vulnerability

CVE-2026-16769 Overview

CVE-2026-16769 is a denial of service vulnerability affecting Silicon Labs RS9116W and SiWx917 wireless chipsets. An attacker within adjacent network range can send an unencrypted pause encryption request message that the device processes without validation. The malformed request causes the wireless stack to enter a denial of service state, disrupting connectivity for affected devices. The issue is catalogued as vulnerability B-E10 in the referenced research paper and is classified under [CWE-440] (Expected Behavior Violation).

Critical Impact
Adjacent-network attackers can trigger a denial of service on RS9116W/SiWx917 wireless devices without authentication or user interaction.

Affected Products

Silicon Labs RS9116W wireless module
Silicon Labs SiWx917 wireless SoC
Embedded and IoT deployments using the affected Wi-Fi stack

Discovery Timeline

2026-09-08 - CVE-2026-16769 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-16769

Vulnerability Analysis

The vulnerability resides in the Wi-Fi protocol handling logic of the RS9116W and SiWx917 chipsets. The device accepts a pause encryption request frame that arrives without encryption protection. Normal protocol behavior requires this control message to be authenticated and encrypted within an established session. The affected firmware fails to enforce that expectation and processes the unprotected frame, resulting in a service disruption.

The flaw is tracked as issue B-E10 in the published research analyzing Wi-Fi implementation weaknesses across multiple vendors. Attackers do not need credentials or user interaction to exploit the flaw. The attack requires adjacent network access, meaning the attacker must be within radio range of the target device.

Root Cause

The root cause is improper enforcement of expected protocol state. The wireless stack acts on a control message that should be rejected when received outside an encrypted session. This behavior violates the protocol specification and maps directly to [CWE-440]. Because the check is missing, a single crafted frame can force the device into a non-operational state.

Attack Vector

Exploitation requires the attacker to be within wireless range of the target. The attacker transmits a crafted, unencrypted pause encryption request frame targeting the affected device. The device processes the frame and enters a denial of service condition, interrupting availability. No authentication, credentials, or user interaction are needed.

Technical details are documented in the ArXiv Research Paper and the Silicon Labs Community Post. No public proof-of-concept exploit code is available at the time of publication.

Detection Methods for CVE-2026-16769

Indicators of Compromise

Unexpected wireless disconnections or repeated re-association events on RS9116W or SiWx917 devices.
Presence of unencrypted pause encryption request frames in nearby Wi-Fi capture data.
Loss of network availability for IoT endpoints without corresponding infrastructure faults.

Detection Strategies

Deploy wireless intrusion detection sensors that flag management or control frames arriving outside expected encryption state.
Capture and inspect 802.11 traffic near affected devices for anomalous encryption pause requests.
Correlate device reboot and radio reset telemetry with nearby wireless activity to identify targeted disruption.

Monitoring Recommendations

Forward device availability metrics and wireless connection logs to a central analytics platform for anomaly review.
Track baseline connection stability for RS9116W and SiWx917 fleets and alert on statistical deviations.
Monitor vendor advisories from Silicon Labs for firmware updates addressing B-E10.

How to Mitigate CVE-2026-16769

Immediate Actions Required

Inventory all deployments containing RS9116W and SiWx917 modules and identify their firmware versions.
Apply firmware updates from Silicon Labs as soon as they are published for this issue.
Restrict physical and radio-frequency access to environments hosting affected devices where feasible.

Patch Information

Refer to the Silicon Labs Community Post for vendor guidance and firmware availability. No fixed version is listed in the NVD record at the time of publication. Operators should subscribe to Silicon Labs security notifications and validate patch levels against vendor releases.

Workarounds

Isolate affected wireless devices on segmented networks to limit exposure to untrusted radio environments.
Deploy directional antennas and reduce transmit power to shrink the attack surface for adjacent-network attackers.
Enable wireless intrusion prevention features on nearby access points to detect and block malicious frames.

bash

# Example: identify Silicon Labs wireless devices on a Linux host
iw dev
ethtool -i wlan0 | grep -i driver
# Consult Silicon Labs advisories for confirmed patched firmware versions